01Krellix Mail · v3.1.0

Preserve email and documentsin a way a court will accept.

Krellix collects from Microsoft 365 or any IMAP mailbox, hashes every file, and RFC 3161 timestamps the whole collection. Built for lawyers, compliance officers, and HR investigators who need a chain of custody that survives a motion to compel — without a Purview seat or a vendor invoice.

Start the 14-day trial See how it works

SHA-256 + MD5RFC 3161 timestampedFederal Rules 901 / 902(14) ready

→ Runs on the operator's Windows machine

→ No data leaves your control

→ Delivered in plain, open formats

02The gap Krellix fills

Defensible collection shouldn't require an E5 license.

Most small firms and mid-market companies don't have Microsoft Purview. The moment a matter requires preserved email, the options narrow to three: forward messages to yourself (inadmissible), ask IT to PST-export them (no chain of custody), or call a vendor and wait two weeks for a five-figure invoice.

Krellix is the fourth option. One-time license, runs on the operator's machine, produces the same artifacts a vendor would: native .eml files, searchable PDFs, a signed manifest, and a public TSA timestamp.

Personal mode for your own correspondence. Enterprise mode for another custodian's mailbox, OneDrive, and SharePoint. Same defensibility in both.

03How it works

Four steps. Same output every time.

From sign-in to sealed export, a typical collection takes under thirty minutes of operator time.

Full walkthrough, with screenshots

Sign in and scope

Authenticate with your own Microsoft 365 credentials or IMAP login. Pick a custodian — yourself in Personal mode, another user in Enterprise mode — and a date range, subject filter, or sender list.

Collect and preserve

Krellix pulls messages through the official Microsoft Graph API (or IMAP), writes native .eml files and searchable PDFs, and captures each attachment in its original format. No intermediate server, no copy in the cloud.

Hash and seal

Every exported file gets a SHA-256 and MD5 hash. A manifest records the operator, tenant, custodian, query, counts, and hashes — then that manifest itself is SHA-256 hashed and sent to a public Time Stamp Authority.

Deliver and verify

The export lands on your disk as seven numbered folders. Any reviewer can re-hash the files and re-verify the TSA signature with OpenSSL. The verify steps ship inside the export as a VERIFY.md file.

04What you ship

The manifest is the artifact that wins the argument.

Every export includes a signed JSON record of exactly who collected what, when, from whom, and what query was used. It's timestamped by a public Time Stamp Authority so the collection time isn't your word against opposing counsel's — it's DigiCert's.

Why this holds up in court How to verify one yourself

ChainOfCustody.json

excerpt

{
  "manifestVersion":  "3.1",
  "product":          "Krellix Mail 3.1.0",
  "collectionId":     "krx-2026-0418-a41c9e",
  "startedUtc":       "2026-04-18T13:22:41Z",
  "completedUtc":     "2026-04-18T13:47:05Z",
  "operator": {
    "upn":            "j.rourke@millerscottlaw.com",
    "displayName":    "Jordan Rourke",
    "oid":            "f8a1d6c2-7b39-4d5e-a0f2-3c71b2e94a6d"
  },
  "tenant": {
    "tenantId":       "c1d7f2b0-9a3e-4b5c-8d71-2e4f60a81c93",
    "tenantDomain":   "millerscottlaw.onmicrosoft.com"
  },
  "custodian": {
    "upn":            "d.marquez@millerscottlaw.com",
    "displayName":    "Diana Marquez",
    "mailboxType":    "UserMailbox"
  },
  "query": {
    "mode":           "Enterprise",
    "endpoint":       "/users/d.marquez@millerscottlaw.com/messages",
    "kqlFilter":      "receivedDateTime ge 2025-09-01T00:00:00Z and receivedDateTime lt 2026-03-01T00:00:00Z"
  },
  "counts": {
    "messages":       4182,
    "attachments":    1776,
    "deduplicated":   312
  },
  "firstItem": {
    "graphId":        "AAMkAGRhYzkyMTk4LWY4OWMtNDA3OC1hY2UxLTA0ZWUzMjE1ZTRjMABGAAAAAAD",
    "subject":        "Re: Q3 renewal — revised terms",
    "receivedUtc":    "2025-09-03T14:08:22Z",
    "sha256":         "9f2a5c3b0e8d4f1726a9b4e7d0c8f391a2b5e6c8d9f0a1b2c3d4e5f6a7b8c9d0",
    "md5":            "b4a7c1e2f3d4a5b6c7d8e9f0a1b2c3d4"
  },
  "timestamp": {
    "tsa":            "http://timestamp.digicert.com",
    "policyOid":      "2.16.840.1.114412.7.1",
    "serialNumber":   "07:8e:3a:4c:92:5d:11:f0:c8:6a:2b:41:9e:5d:03:88",
    "timestampedUtc": "2026-04-18T13:47:18Z",
    "tokenPath":      "07_TimestampMaterials/manifest.tsr",
    "hashAlgorithm":  "SHA-256",
    "manifestDigest": "2b9e07f1a4c8d6b5e3f0921a74c6d8b9e1f0a2b3c4d5e6f7a8b9c0d1e2f3a4b5"
  }
}

05Who uses Krellix

Built for the person who needs the evidence, not the person who manages the tenant.

Solo & small-firm attorneys

Preserve your client correspondence at the start of a matter without sending it to a vendor. Most Krellix exports cost less than one billable hour.

In-house counsel

Your company has Business Premium, not E5 Compliance. Krellix gives you the defensible collection that Purview would — without the $57/user/month license.

HR investigators

Preserve email surrounding a conduct investigation before custodians know they're under review. The manifest documents the chain of custody; your legal team can attest to it in court.

Compliance officers

Regulated industries need ad-hoc preservation for SEC, FINRA, OCC, and HIPAA responses. Krellix produces audit-ready output without procurement for a full eDiscovery platform.

06Pricing

$499 or $1,999 a year. Published on the pricing page.

No per-seat pricing, no per-custodian pricing, no per-gigabyte pricing. One operator seat, unlimited collections for the license term. Personal pays for itself on the first matter. Enterprise pays for itself by lunchtime on the first custodian.

See what's included Try it for 14 days first

Personal: $499; / year
Enterprise: $1,999; / year
Trial: 14 days, full feature set, no credit card.

Next step

Ready to collect your first defensible export?

Download the 14-day trial. No credit card, no sales call — just the real build on your machine. If it doesn't hold up under a motion to compel, don't pay.

Start the 14-day trial See a sample export